New Kubernetes Service Account Created

Rule Info

Name
New Kubernetes Service Account Created
Author
Leo Tsaousis (@laripping)
Description
Detects creation of new Kubernetes service account, which could indicate an attacker's attempt to persist within a cluster.
Reference
https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/container%20service%20account/
Date
2024-03-26 00:00:00
Modified
None
Id
e31bae15-83ed-473e-bf31-faf4f8a17d36
Tags
attack.t1136
Type
Community Rule
Link to Public Repo
https://github.com/SigmaHQ/sigma/search?q=e31bae15-83ed-473e-bf31-faf4f8a17d36

Rule History

Author
Title
Date
Commit
Nasreddine Bencherchali
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12
598d29f81
Leo Tsaousis
Merge PR #4694 from @LAripping - Add native Kubernetes detections
2024-03-26
0d63f52ff
THOR Logo  Scan your endpoints, forensic images or collected files with our portable scanner THOR
  Warning: Access to VALHALLA is rate-limited - once you prove unworthy, access gets denied
  Nextron Systems 2022